A security team wants a single account-level control that prevents any S3 bucket in the account from becoming publicly accessible, regardless of how bucket policies or ACLs are configured. What should they enable?
A.S3 Block Public Access at the account level
Correct. Account-level Block Public Access is the strongest, preventive guardrail.
B.An AWS Config rule that reports public buckets
Config rules detect noncompliance after it happens; they don't prevent it.
C.A daily script that audits bucket policies
Scheduled audits leave windows of exposure and depend on script correctness.
D.Amazon Macie sensitive-data discovery
Macie finds sensitive data in buckets; it does not block public access.
Why this answer
S3 Block Public Access applied at the account level overrides every bucket-level setting and blocks all public access grants account-wide — the preventive (not detective) control the scenario requires.
Correct answer: A · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption